CVE-2020-8424: Cross-Site Request Forgery (CSRF)

Cups Easy Purchase & Inventory 1.0 is vulnerable to CSRF that leads to admin account takeover via passwordmychange.php...

CVE-2020-8425: Cross-Site Request Forgery (CSRF)

Cups Easy Purchase & Inventory 1.0 is vulnerable to CSRF that leads to admin account deletion via userdelete.php...

Design/Logic Flaw

D-Link DSR-250N devices with firmware 1.05B73WW allow Persistent Root Access because of the admin password for the admin account...

CVE-2020-7249

SMC D3G0804W 3.5.2.5-LATGA devices allow XSS via the SSID field on the WiFi Network Configuration page after a successful login to the admin account...

CVE-2020-7249

SMC D3G0804W 3.5.2.5-LATGA devices allow XSS via the SSID field on the WiFi Network Configuration page after a successful login to the admin account...

CVE-2020-7249: Improper Neutralization of Input During Web Page Generation

SMC D3G0804W 3.5.2.5-LATGA devices allow XSS via the SSID field on the WiFi Network Configuration page after a successful login to the admin account...

CVE-2012-1563

Joomla! before 2.5.3 allows Admin Account Creation...

Design/Logic Flaw

Joomla! before 2.5.3 allows Admin Account Creation...

CVE-2012-1563

CVE-2012-1563 is described across multiple sources as a Joomla! vulnerability that allows an attacker to create an administrator account in affected installations. The core issue is consistently referenced as Joomla! before 2.5.3, with exploit tooling and public writeups targeting Joomla! 2.5.x (...

CVE-2012-1563

Joomla! before 2.5.3 allows Admin Account Creation...

CVE-2012-1563: Improper Privilege Management

Joomla! before 2.5.3 allows Admin Account Creation...

CVE-2020-6949

A privilege escalation issue was discovered in the postUser function in HashBrown CMS through 1.3.3. An editor user can change the password hash of an admin user's account, or otherwise reconfigure that account...

Privilege escalation

A privilege escalation issue was discovered in the postUser function in HashBrown CMS through 1.3.3. An editor user can change the password hash of an admin user's account, or otherwise reconfigure that account...

CVE-2020-6949: Improper Privilege Management

A privilege escalation issue was discovered in the postUser function in HashBrown CMS through 1.3.3. An editor user can change the password hash of an admin user's account, or otherwise reconfigure that account...

CVE-2020-6583

BigProf Online Invoicing System OIS through 2.6 has XSS that can be leveraged for session hijacking. An attacker can exploit the XSS vulnerability, retrieve the session cookie from the administrator login, and take over the administrator account via the Name field in an Add New Client action...

Small CRM 2.0 - Authentication Bypass Vulnerability

Exploit for php platform in category web applications Exploit Title: Small CRM 2.0 - Authentication Bypass Exploit Author: FULLSHADE Vendor Homepage: https://phpgurukul.com/ Software Link: https://phpgurukul.com/small-crm-php/ Version: V2.0 Tested on: Windows CVE : N/A Description: There is a SQL...

Karakuzu ERP Management Web 5.7.0 - (k_adi_duz) SQL Injection Vulnerability

Exploit for php platform in category web applications Exploit Title: Karakuzu ERP Management Web 5.7.0 - 'kadiduz' SQL Injection Exploit Author: Hakan TAŞKÖPRÜ Vendor Homepage: http://karakuzu.info/ Effected Version = 5.7.0 Vulnerability 1: Unauthenticated SQL Injection...

Small CRM 2.0 SQL Injection

Exploit Title: Small CRM 2.0 - Authentication Bypass Google Dork: N/A Date: 2020-01-02 Exploit Author: FULLSHADE Vendor Homepage: https://phpgurukul.com/ Software Link: https://phpgurukul.com/small-crm-php/ Version: V2.0 Tested on: Windows CVE : N/A Description: There is a SQL injection...

CVE-2019-4716

IBM Planning Analytics 2.0.0 through 2.0.8 is vulnerable to a configuration overwrite that allows an unauthenticated user to login as "admin", and then execute code as root or SYSTEM via TM1 scripting. IBM X-Force ID: 172094...

Various Jira Server setup resources are vulnerable to XSRF/CSRF - CVE-2019-20401

Various installation setup resources in Jira before version 8.5.2 allow remote attackers to configure a Jira instance, which has not yet finished being installed, via Cross-site request forgery CSRF vulnerabilities. Once a Jira instance is setup i.e. database, admin account, licence, etc. form ar...